#include"Nexton.h" #include"embed_util.h" /** * jichi 9/5/2013: NEXTON games with aInfo.db * Sample games: * - /HA-C@4D69E:InnocentBullet.exe (イノセントバレッ�) * - /HA-C@40414C:ImoutoBancho.exe (妹番長) * * See: http://ja.wikipedia.org/wiki/ネクストン * See (CaoNiMaGeBi): http://tieba.baidu.com/p/2576241908 * * Old: * md5 = 85ac031f2539e1827d9a1d9fbde4023d * hcode = /HA-C@40414C:ImoutoBancho.exe * - addr: 4211020 (0x40414c) * - module: 1051997988 (0x3eb43724) * - length_offset: 1 * - off: 4294967280 (0xfffffff0) = -0x10 * - split: 0 * - type: 68 (0x44) * * New (11/7/2013): * /HA-20:4@583DE:MN2.EXE (NEW) * - addr: 361438 (0x583de) * - module: 3436540819 * - length_offset: 1 * - off: 4294967260 (0xffffffdc) = -0x24 * - split: 4 * - type: 84 (0x54) */ bool InsertNextonHook() { #if 0 // 0x8944241885c00f84 const BYTE bytes[] = { //0xe8 //??,??,??,??, 00804147 e8 24d90100 call imoutoba.00821a70 0x89,0x44,0x24, 0x18, // 0080414c 894424 18 mov dword ptr ss:[esp+0x18],eax; hook here 0x85,0xc0, // 00804150 85c0 test eax,eax 0x0f,0x84 // 00804152 ^0f84 c0feffff je imoutoba.00804018 }; //enum { addr_offset = 0 }; ULONG addr = processStartAddress; //- sizeof(bytes); do { addr += sizeof(bytes); // ++ so that each time return diff address ULONG range = min(processStopAddress - addr, MAX_REL_ADDR); addr = MemDbg::findBytes(bytes, sizeof(bytes), addr, addr + range); if (!addr) { ConsoleOutput("NEXTON: pattern not exist"); return false; } //const BYTE hook_ins[] = { // 0x57, // 00804144 57 push edi // 0x8b,0xc3, // 00804145 8bc3 mov eax,ebx // 0xe8 //??,??,??,??, 00804147 e8 24d90100 call imoutoba.00821a70 //}; } while(0xe8c38b57 != *(DWORD *)(addr - 8)); #endif // 0 const BYTE bytes[] = { 0x57, // 0044d696 57 push edi 0x8b,0xc3, // 0044d697 8bc3 mov eax,ebx 0xe8, XX4, // 0044d699 e8 6249fdff call .00422000 0x89,0x44,0x24, 0x18, // 0044d69e 894424 18 mov dword ptr ss:[esp+0x18],eax ; jichi: this is the ith hook point 0x85,0xc0, // 0044d6a2 85c0 test eax,eax 0x0f,0x84 //c2feffff // 0044d6a4 ^0f84 c2feffff je .0044d56c }; enum { addr_offset = 0x0044d69e - 0x0044d696 }; // = 8 ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress); if (!addr) { ConsoleOutput("NEXTON: pattern not exist"); return false; } HookParam hp; hp.address = addr + addr_offset; //hp.type = CODEC_ANSI_BE; // 4 // 魔王のくせに生イキ�っ �今度は性戦ぽ // CheatEngine search for byte array: 8944241885C00F84 //addr = 0x4583de; // wrong //addr = 0x5460ba; //addr = 0x5f3d8a; //addr = 0x768776; //addr = 0x7a5319; hp.offset=get_reg(regs::edi); hp.split=get_stack(1); hp.type = CODEC_ANSI_BE|USING_SPLIT; // 0x54 // Indirect is needed for new games, // Such as: /HA-C*0@4583DE for 「魔王のくせに生イキ�っ��� //hp.type = CODEC_ANSI_BE|DATA_INDIRECT; // 12 //hp.type = CODEC_UTF16; //GROWL_DWORD3(addr, -hp.offset, hp.type); ConsoleOutput("INSERT NEXTON"); return NewHook(hp, "NEXTON"); //ConsoleOutput("NEXTON: disable GDI hooks"); // There are no GDI functions hooked though // // disable GetGlyphOutlineA } namespace { // unnamed namespace ScenarioHook { namespace Private { /** * Scenario caller: * 0047D555 8BCE MOV ECX,ESI * 0047D557 FFD0 CALL EAX * 0047D559 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+0x8] * 0047D55C 51 PUSH ECX * 0047D55D 8BCE MOV ECX,ESI * 0047D55F E8 ECFDFCFF CALL .0044D350 ; jichi: scenario called here * 0047D564 A1 0C839800 MOV EAX,DWORD PTR DS:[0x98830C] * 0047D569 C746 38 00000000 MOV DWORD PTR DS:[ESI+0x38],0x0 * 0047D570 8BB7 20040000 MOV ESI,DWORD PTR DS:[EDI+0x420] * 0047D576 8B50 14 MOV EDX,DWORD PTR DS:[EAX+0x14] * 0047D579 2B50 10 SUB EDX,DWORD PTR DS:[EAX+0x10] * 0047D57C 8D78 10 LEA EDI,DWORD PTR DS:[EAX+0x10] * 0047D57F C1FA 02 SAR EDX,0x2 * 0047D582 3BF2 CMP ESI,EDX * 0047D584 72 05 JB SHORT .0047D58B * 0047D586 E8 091C0300 CALL .004AF194 * 0047D58B 8B07 MOV EAX,DWORD PTR DS:[EDI] * 0047D58D 8B34B0 MOV ESI,DWORD PTR DS:[EAX+ESI*4] * 0047D590 8B16 MOV EDX,DWORD PTR DS:[ESI] * 0047D592 8B42 04 MOV EAX,DWORD PTR DS:[EDX+0x4] * 0047D595 8BCE MOV ECX,ESI * 0047D597 FFD0 CALL EAX * 0047D599 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0xC] * 0047D59C 51 PUSH ECX * 0047D59D 8BCE MOV ECX,ESI * 0047D59F E8 ACFDFCFF CALL .0044D350 ; jichi: name called here * 0047D5A4 5F POP EDI * 0047D5A5 5E POP ESI * 0047D5A6 5B POP EBX * 0047D5A7 8BE5 MOV ESP,EBP * 0047D5A9 5D POP EBP * 0047D5AA C2 0800 RETN 0x8 * 0047D5AD CC INT3 * 0047D5AE CC INT3 * 0047D5AF CC INT3 * * History: * * 0047C054 50 PUSH EAX * 0047C055 8BCF MOV ECX,EDI * 0047C057 E8 F412FDFF CALL .0044D350 ; jichi: name history called here * 0047C05C 46 INC ESI * 0047C05D 3B7424 14 CMP ESI,DWORD PTR SS:[ESP+0x14] * 0047C061 ^0F82 EAFEFFFF JB .0047BF51 * 0047C067 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+0x20] * 0047C06B 3BF1 CMP ESI,ECX * 0047C06D 0F83 A7000000 JNB .0047C11A * 0047C073 EB 0B JMP SHORT .0047C080 * 0047C075 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP] * 0047C07C 8D6424 00 LEA ESP,DWORD PTR SS:[ESP] * 0047C080 8B8B 483A0000 MOV ECX,DWORD PTR DS:[EBX+0x3A48] * 0047C086 2B8B 443A0000 SUB ECX,DWORD PTR DS:[EBX+0x3A44] * 0047C08C C1F9 03 SAR ECX,0x3 * 0047C08F 3BF1 CMP ESI,ECX * 0047C091 72 05 JB SHORT .0047C098 * * 0045BFCF 53 PUSH EBX * 0045BFD0 53 PUSH EBX * 0045BFD1 E8 15670500 CALL .004B26EB ; jichi: scenario history called here * 0045BFD6 8BC6 MOV EAX,ESI * 0045BFD8 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-0xC] * 0045BFDB 64:890D 00000000 MOV DWORD PTR FS:[0],ECX * 0045BFE2 59 POP ECX * 0045BFE3 5F POP EDI * 0045BFE4 5E POP ESI * 0045BFE5 5B POP EBX * 0045BFE6 8BE5 MOV ESP,EBP * 0045BFE8 5D POP EBP * 0045BFE9 C3 RETN * 0045BFEA CC INT3 */ bool hookBefore(hook_stack*s,void* data, size_t* len1,uintptr_t*role) { static std::string data_; auto text = (LPCSTR)s->stack[1]; // arg1 if (!text || !*text) return false; * role = Engine::OtherRole; auto retaddr = s->stack[0]; BYTE ins = *(BYTE *)retaddr; if (ins == 0xa1) // 0047D564 A1 0C839800 MOV EAX,DWORD PTR DS:[0x98830C] *role = Engine::ScenarioRole; else if (ins == 0x5f) // 0047D5A4 5F POP EDI *role = Engine::NameRole; write_string_overwrite(data,len1,text); return true; } } // namespace Private /** * Sample game: Innocent Bullet * * Name/Scenario/History are translated in different callers. * * 0044D34D CC INT3 * 0044D34E CC INT3 * 0044D34F CC INT3 * 0044D350 55 PUSH EBP * 0044D351 8BEC MOV EBP,ESP * 0044D353 83E4 F8 AND ESP,0xFFFFFFF8 * 0044D356 6A FF PUSH -0x1 * 0044D358 68 30B88800 PUSH .0088B830 * 0044D35D 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] * 0044D363 50 PUSH EAX * 0044D364 81EC B0000000 SUB ESP,0xB0 * 0044D36A A1 50569600 MOV EAX,DWORD PTR DS:[0x965650] * 0044D36F 33C4 XOR EAX,ESP * 0044D371 898424 A8000000 MOV DWORD PTR SS:[ESP+0xA8],EAX * 0044D378 53 PUSH EBX * 0044D379 56 PUSH ESI * 0044D37A 57 PUSH EDI * 0044D37B A1 50569600 MOV EAX,DWORD PTR DS:[0x965650] * 0044D380 33C4 XOR EAX,ESP * 0044D382 50 PUSH EAX * 0044D383 8D8424 C0000000 LEA EAX,DWORD PTR SS:[ESP+0xC0] * 0044D38A 64:A3 00000000 MOV DWORD PTR FS:[0],EAX * 0044D390 8B45 08 MOV EAX,DWORD PTR SS:[EBP+0x8] * 0044D393 8BF1 MOV ESI,ECX * 0044D395 8B16 MOV EDX,DWORD PTR DS:[ESI] * 0044D397 894424 38 MOV DWORD PTR SS:[ESP+0x38],EAX * 0044D39B 8B42 04 MOV EAX,DWORD PTR DS:[EDX+0x4] * 0044D39E 897424 34 MOV DWORD PTR SS:[ESP+0x34],ESI * 0044D3A2 FFD0 CALL EAX * 0044D3A4 68 60244200 PUSH .00422460 * 0044D3A9 B9 EC769800 MOV ECX,.009876EC * 0044D3AE E8 FD41FDFF CALL .004215B0 * 0044D3B3 8B3D F4769800 MOV EDI,DWORD PTR DS:[0x9876F4] * 0044D3B9 8B47 30 MOV EAX,DWORD PTR DS:[EDI+0x30] * 0044D3BC 2B47 2C SUB EAX,DWORD PTR DS:[EDI+0x2C] * 0044D3BF 8B5E 04 MOV EBX,DWORD PTR DS:[ESI+0x4] * 0044D3C2 83C7 20 ADD EDI,0x20 * 0044D3C5 33C9 XOR ECX,ECX * 0044D3C7 83C4 04 ADD ESP,0x4 * 0044D3CA C1F8 02 SAR EAX,0x2 * 0044D3CD 3BD9 CMP EBX,ECX * 0044D3CF 7C 24 JL SHORT .0044D3F5 * 0044D3D1 3BC3 CMP EAX,EBX * 0044D3D3 7E 20 JLE SHORT .0044D3F5 * 0044D3D5 8B57 10 MOV EDX,DWORD PTR DS:[EDI+0x10] * 0044D3D8 2B57 0C SUB EDX,DWORD PTR DS:[EDI+0xC] * 0044D3DB C1FA 02 SAR EDX,0x2 * 0044D3DE 3BDA CMP EBX,EDX * 0044D3E0 72 07 JB SHORT .0044D3E9 * 0044D3E2 E8 AD1D0600 CALL .004AF194 * 0044D3E7 33C9 XOR ECX,ECX * 0044D3E9 8B47 0C MOV EAX,DWORD PTR DS:[EDI+0xC] * 0044D3EC 8B1498 MOV EDX,DWORD PTR DS:[EAX+EBX*4] * 0044D3EF 895424 1C MOV DWORD PTR SS:[ESP+0x1C],EDX * 0044D3F3 EB 04 JMP SHORT .0044D3F9 * 0044D3F5 894C24 1C MOV DWORD PTR SS:[ESP+0x1C],ECX * 0044D3F9 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+0x1C] * 0044D3FD D9EE FLDZ * 0044D3FF 83C0 34 ADD EAX,0x34 * 0044D402 D95C24 14 FSTP DWORD PTR SS:[ESP+0x14] * 0044D406 894424 4C MOV DWORD PTR SS:[ESP+0x4C],EAX * 0044D40A 8B00 MOV EAX,DWORD PTR DS:[EAX] * 0044D40C 894424 18 MOV DWORD PTR SS:[ESP+0x18],EAX * 0044D410 DB4424 18 FILD DWORD PTR SS:[ESP+0x18] * 0044D414 85C0 TEST EAX,EAX * 0044D416 7D 06 JGE SHORT .0044D41E * 0044D418 D805 D05C9100 FADD DWORD PTR DS:[0x915CD0] * 0044D41E 894C24 3C MOV DWORD PTR SS:[ESP+0x3C],ECX * 0044D422 D95C24 28 FSTP DWORD PTR SS:[ESP+0x28] * 0044D426 894C24 2C MOV DWORD PTR SS:[ESP+0x2C],ECX * 0044D42A 8D4C24 70 LEA ECX,DWORD PTR SS:[ESP+0x70] * 0044D42E 51 PUSH ECX * 0044D42F C74424 70 60DC90>MOV DWORD PTR SS:[ESP+0x70],.0090DC60 * 0044D437 E8 242B0000 CALL .0044FF60 * 0044D43C 33FF XOR EDI,EDI * 0044D43E 8D5424 6C LEA EDX,DWORD PTR SS:[ESP+0x6C] * 0044D442 89BC24 C8000000 MOV DWORD PTR SS:[ESP+0xC8],EDI * 0044D449 8B4C24 38 MOV ECX,DWORD PTR SS:[ESP+0x38] * 0044D44D 52 PUSH EDX * 0044D44E E8 6D150000 CALL .0044E9C0 * 0044D453 8B8424 80000000 MOV EAX,DWORD PTR SS:[ESP+0x80] * 0044D45A 8B4C24 7C MOV ECX,DWORD PTR SS:[ESP+0x7C] * 0044D45E 894424 60 MOV DWORD PTR SS:[ESP+0x60],EAX * 0044D462 3BC8 CMP ECX,EAX * 0044D464 76 10 JBE SHORT .0044D476 * 0044D466 E8 291D0600 CALL .004AF194 * 0044D46B 8B8424 80000000 MOV EAX,DWORD PTR SS:[ESP+0x80] * 0044D472 8B4C24 7C MOV ECX,DWORD PTR SS:[ESP+0x7C] * 0044D476 8B5424 70 MOV EDX,DWORD PTR SS:[ESP+0x70] * 0044D47A 895424 58 MOV DWORD PTR SS:[ESP+0x58],EDX * 0044D47E 897C24 38 MOV DWORD PTR SS:[ESP+0x38],EDI * 0044D482 8BD9 MOV EBX,ECX * 0044D484 3BC8 CMP ECX,EAX * 0044D486 76 05 JBE SHORT .0044D48D * 0044D488 E8 071D0600 CALL .004AF194 * 0044D48D 8B7C24 70 MOV EDI,DWORD PTR SS:[ESP+0x70] * 0044D491 897C24 50 MOV DWORD PTR SS:[ESP+0x50],EDI * 0044D495 895C24 54 MOV DWORD PTR SS:[ESP+0x54],EBX * 0044D499 85FF TEST EDI,EDI * 0044D49B 74 06 JE SHORT .0044D4A3 * 0044D49D 3B7C24 58 CMP EDI,DWORD PTR SS:[ESP+0x58] * 0044D4A1 74 05 JE SHORT .0044D4A8 * 0044D4A3 E8 EC1C0600 CALL .004AF194 * 0044D4A8 3B5C24 60 CMP EBX,DWORD PTR SS:[ESP+0x60] * 0044D4AC 0F84 E4030000 JE .0044D896 * 0044D4B2 85FF TEST EDI,EDI * 0044D4B4 0F85 9C000000 JNZ .0044D556 * 0044D4BA E8 D51C0600 CALL .004AF194 * 0044D4BF 33C0 XOR EAX,EAX * 0044D4C1 3B58 10 CMP EBX,DWORD PTR DS:[EAX+0x10] * 0044D4C4 72 05 JB SHORT .0044D4CB * 0044D4C6 E8 C91C0600 CALL .004AF194 * 0044D4CB 8B0B MOV ECX,DWORD PTR DS:[EBX] * 0044D4CD 8B01 MOV EAX,DWORD PTR DS:[ECX] * 0044D4CF 8B50 10 MOV EDX,DWORD PTR DS:[EAX+0x10] * 0044D4D2 FFD2 CALL EDX * 0044D4D4 85C0 TEST EAX,EAX * 0044D4D6 0F85 99030000 JNZ .0044D875 * 0044D4DC 85FF TEST EDI,EDI * 0044D4DE 75 7D JNZ SHORT .0044D55D * 0044D4E0 E8 AF1C0600 CALL .004AF194 * 0044D4E5 3B5F 10 CMP EBX,DWORD PTR DS:[EDI+0x10] * 0044D4E8 72 05 JB SHORT .0044D4EF * 0044D4EA E8 A51C0600 CALL .004AF194 * 0044D4EF 8B0B MOV ECX,DWORD PTR DS:[EBX] * 0044D4F1 8B01 MOV EAX,DWORD PTR DS:[ECX] * 0044D4F3 8B50 08 MOV EDX,DWORD PTR DS:[EAX+0x8] * 0044D4F6 FFD2 CALL EDX * 0044D4F8 8BC8 MOV ECX,EAX * 0044D4FA C78424 B4000000 >MOV DWORD PTR SS:[ESP+0xB4],0xF * 0044D505 C78424 B0000000 >MOV DWORD PTR SS:[ESP+0xB0],0x0 * 0044D510 C68424 A0000000 >MOV BYTE PTR SS:[ESP+0xA0],0x0 * 0044D518 8D79 01 LEA EDI,DWORD PTR DS:[ECX+0x1] * 0044D51B EB 03 JMP SHORT .0044D520 * 0044D51D 8D49 00 LEA ECX,DWORD PTR DS:[ECX] * 0044D520 8A11 MOV DL,BYTE PTR DS:[ECX] * 0044D522 41 INC ECX * 0044D523 84D2 TEST DL,DL * 0044D525 ^75 F9 JNZ SHORT .0044D520 * 0044D527 2BCF SUB ECX,EDI * 0044D529 51 PUSH ECX * 0044D52A 50 PUSH EAX * 0044D52B 8D8C24 A4000000 LEA ECX,DWORD PTR SS:[ESP+0xA4] * 0044D532 E8 D934FCFF CALL .00410A10 * 0044D537 C68424 C8000000 >MOV BYTE PTR SS:[ESP+0xC8],0x1 * 0044D53F 83BC24 B4000000 >CMP DWORD PTR SS:[ESP+0xB4],0x10 * 0044D547 72 18 JB SHORT .0044D561 * 0044D549 8B8424 A0000000 MOV EAX,DWORD PTR SS:[ESP+0xA0] * 0044D550 894424 30 MOV DWORD PTR SS:[ESP+0x30],EAX * 0044D554 EB 16 JMP SHORT .0044D56C * 0044D556 8B07 MOV EAX,DWORD PTR DS:[EDI] * 0044D558 ^E9 64FFFFFF JMP .0044D4C1 * 0044D55D 8B3F MOV EDI,DWORD PTR DS:[EDI] * 0044D55F ^EB 84 JMP SHORT .0044D4E5 * 0044D561 8D8C24 A0000000 LEA ECX,DWORD PTR SS:[ESP+0xA0] * 0044D568 894C24 30 MOV DWORD PTR SS:[ESP+0x30],ECX * 0044D56C 8B7C24 30 MOV EDI,DWORD PTR SS:[ESP+0x30] * 0044D570 0FB617 MOVZX EDX,BYTE PTR DS:[EDI] * 0044D573 52 PUSH EDX * 0044D574 33DB XOR EBX,EBX * 0044D576 E8 39420600 CALL .004B17B4 * 0044D57B 83C4 04 ADD ESP,0x4 * 0044D57E 85C0 TEST EAX,EAX * 0044D580 74 12 JE SHORT .0044D594 * 0044D582 8BCF MOV ECX,EDI * 0044D584 3859 01 CMP BYTE PTR DS:[ECX+0x1],BL * 0044D587 8D41 01 LEA EAX,DWORD PTR DS:[ECX+0x1] * 0044D58A 74 08 JE SHORT .0044D594 * 0044D58C 0FB619 MOVZX EBX,BYTE PTR DS:[ECX] * 0044D58F C1E3 08 SHL EBX,0x8 * 0044D592 8BF8 MOV EDI,EAX * 0044D594 0FB63F MOVZX EDI,BYTE PTR DS:[EDI] * 0044D597 03FB ADD EDI,EBX * 0044D599 0F84 8E020000 JE .0044D82D * 0044D59F D94424 28 FLD DWORD PTR SS:[ESP+0x28] * 0044D5A3 D946 0C FLD DWORD PTR DS:[ESI+0xC] * 0044D5A6 DED9 FCOMPP * 0044D5A8 DFE0 FSTSW AX * 0044D5AA F6C4 05 TEST AH,0x5 * 0044D5AD 0F8B 7A020000 JPO .0044D82D * 0044D5B3 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+0x30] * 0044D5B7 50 PUSH EAX * 0044D5B8 E8 0F420600 CALL .004B17CC * 0044D5BD 83C4 04 ADD ESP,0x4 * 0044D5C0 894424 30 MOV DWORD PTR SS:[ESP+0x30],EAX * 0044D5C4 83FF 20 CMP EDI,0x20 * 0044D5C7 75 27 JNZ SHORT .0044D5F0 * 0044D5C9 FF86 88000000 INC DWORD PTR DS:[ESI+0x88] * 0044D5CF 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C] * 0044D5D3 8B51 38 MOV EDX,DWORD PTR DS:[ECX+0x38] * 0044D5D6 DB41 38 FILD DWORD PTR DS:[ECX+0x38] * 0044D5D9 85D2 TEST EDX,EDX * 0044D5DB 7D 06 JGE SHORT .0044D5E3 * 0044D5DD D805 D05C9100 FADD DWORD PTR DS:[0x915CD0] * 0044D5E3 D84424 14 FADD DWORD PTR SS:[ESP+0x14] * 0044D5E7 D95C24 14 FSTP DWORD PTR SS:[ESP+0x14] * 0044D5EB ^E9 7CFFFFFF JMP .0044D56C * 0044D5F0 81FF 40810000 CMP EDI,0x8140 * 0044D5F6 75 14 JNZ SHORT .0044D60C * 0044D5F8 FF86 88000000 INC DWORD PTR DS:[ESI+0x88] * 0044D5FE 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+0x1C] * 0044D602 8B48 3C MOV ECX,DWORD PTR DS:[EAX+0x3C] * 0044D605 DB40 3C FILD DWORD PTR DS:[EAX+0x3C] * 0044D608 85C9 TEST ECX,ECX * 0044D60A ^EB CF JMP SHORT .0044D5DB * 0044D60C 83FF 0A CMP EDI,0xA * 0044D60F 75 6F JNZ SHORT .0044D680 * 0044D611 8B46 18 MOV EAX,DWORD PTR DS:[ESI+0x18] * 0044D614 83F8 03 CMP EAX,0x3 * 0044D617 77 3D JA SHORT .0044D656 * 0044D619 FF2485 98DA4400 JMP DWORD PTR DS:[EAX*4+0x44DA98] * 0044D620 56 PUSH ESI * 0044D621 E8 3A080000 CALL .0044DE60 * 0044D626 EB 2E JMP SHORT .0044D656 * 0044D628 D94424 14 FLD DWORD PTR SS:[ESP+0x14] * 0044D62C 51 PUSH ECX * 0044D62D D91C24 FSTP DWORD PTR SS:[ESP] * 0044D630 56 PUSH ESI * 0044D631 E8 FA080000 CALL .0044DF30 * 0044D636 EB 1E JMP SHORT .0044D656 * 0044D638 D94424 14 FLD DWORD PTR SS:[ESP+0x14] * 0044D63C 51 PUSH ECX * 0044D63D D91C24 FSTP DWORD PTR SS:[ESP] * 0044D640 56 PUSH ESI * 0044D641 E8 CA090000 CALL .0044E010 * 0044D646 EB 0E JMP SHORT .0044D656 * 0044D648 D94424 14 FLD DWORD PTR SS:[ESP+0x14] * 0044D64C 51 PUSH ECX * 0044D64D D91C24 FSTP DWORD PTR SS:[ESP] * 0044D650 56 PUSH ESI * 0044D651 E8 9A0A0000 CALL .0044E0F0 * 0044D656 8B5424 4C MOV EDX,DWORD PTR SS:[ESP+0x4C] * 0044D65A D9EE FLDZ * 0044D65C 8B02 MOV EAX,DWORD PTR DS:[EDX] * 0044D65E D95C24 14 FSTP DWORD PTR SS:[ESP+0x14] * 0044D662 D946 14 FLD DWORD PTR DS:[ESI+0x14] * 0044D665 DB02 FILD DWORD PTR DS:[EDX] * 0044D667 85C0 TEST EAX,EAX * 0044D669 7D 06 JGE SHORT .0044D671 * 0044D66B D805 D05C9100 FADD DWORD PTR DS:[0x915CD0] * 0044D671 DEC1 FADDP ST(1),ST * 0044D673 D84424 28 FADD DWORD PTR SS:[ESP+0x28] * 0044D677 D95C24 28 FSTP DWORD PTR SS:[ESP+0x28] * 0044D67B ^E9 ECFEFFFF JMP .0044D56C * 0044D680 83FF 0D CMP EDI,0xD * 0044D683 ^0F84 E3FEFFFF JE .0044D56C * 0044D689 83FF 09 CMP EDI,0x9 * 0044D68C ^0F84 DAFEFFFF JE .0044D56C * 0044D692 8B5C24 1C MOV EBX,DWORD PTR SS:[ESP+0x1C] * 0044D696 57 PUSH EDI * 0044D697 8BC3 MOV EAX,EBX * 0044D699 E8 6249FDFF CALL .00422000 * 0044D69E 894424 18 MOV DWORD PTR SS:[ESP+0x18],EAX ; jichi: This is the ITH hook point * 0044D6A2 85C0 TEST EAX,EAX * 0044D6A4 ^0F84 C2FEFFFF JE .0044D56C * 0044D6AA 57 PUSH EDI * 0044D6AB 8BC3 MOV EAX,EBX * 0044D6AD E8 4E49FDFF CALL .00422000 * 0044D6B2 85C0 TEST EAX,EAX * 0044D6B4 ^0F84 B2FEFFFF JE .0044D56C * 0044D6BA 83C0 10 ADD EAX,0x10 * 0044D6BD 894424 40 MOV DWORD PTR SS:[ESP+0x40],EAX * 0044D6C1 ^0F84 A5FEFFFF JE .0044D56C * 0044D6C7 57 PUSH EDI * 0044D6C8 8BC3 MOV EAX,EBX * 0044D6CA E8 3149FDFF CALL .00422000 * 0044D6CF 85C0 TEST EAX,EAX * 0044D6D1 75 04 JNZ SHORT .0044D6D7 * 0044D6D3 D9EE FLDZ * 0044D6D5 EB 03 JMP SHORT .0044D6DA * 0044D6D7 D940 20 FLD DWORD PTR DS:[EAX+0x20] * 0044D6DA D95C24 24 FSTP DWORD PTR SS:[ESP+0x24] * 0044D6DE 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+0x20] * 0044D6E2 D94424 24 FLD DWORD PTR SS:[ESP+0x24] * 0044D6E6 51 PUSH ECX * 0044D6E7 8D8E 04010000 LEA ECX,DWORD PTR DS:[ESI+0x104] * 0044D6ED D95C24 24 FSTP DWORD PTR SS:[ESP+0x24] * 0044D6F1 E8 6A55FFFF CALL .00442C60 * 0044D6F6 D94424 24 FLD DWORD PTR SS:[ESP+0x24] * 0044D6FA D94424 14 FLD DWORD PTR SS:[ESP+0x14] * 0044D6FE D9C0 FLD ST * 0044D700 DEC2 FADDP ST(2),ST * 0044D702 D946 10 FLD DWORD PTR DS:[ESI+0x10] * 0044D705 DEC2 FADDP ST(2),ST * 0044D707 D9C9 FXCH ST(1) * 0044D709 D95C24 48 FSTP DWORD PTR SS:[ESP+0x48] * 0044D70D D94424 28 FLD DWORD PTR SS:[ESP+0x28] * 0044D711 D95C24 20 FSTP DWORD PTR SS:[ESP+0x20] * 0044D715 D94424 48 FLD DWORD PTR SS:[ESP+0x48] * 0044D719 D946 08 FLD DWORD PTR DS:[ESI+0x8] * 0044D71C DED9 FCOMPP * 0044D71E DFE0 FSTSW AX * 0044D720 F6C4 05 TEST AH,0x5 * 0044D723 7A 47 JPE SHORT .0044D76C * 0044D725 51 PUSH ECX * 0044D726 8BC6 MOV EAX,ESI * 0044D728 D91C24 FSTP DWORD PTR SS:[ESP] * 0044D72B E8 D0060000 CALL .0044DE00 * 0044D730 D94424 24 FLD DWORD PTR SS:[ESP+0x24] * 0044D734 D846 10 FADD DWORD PTR DS:[ESI+0x10] * 0044D737 8B5424 4C MOV EDX,DWORD PTR SS:[ESP+0x4C] * 0044D73B 8B02 MOV EAX,DWORD PTR DS:[EDX] * 0044D73D D95C24 48 FSTP DWORD PTR SS:[ESP+0x48] * 0044D741 D946 14 FLD DWORD PTR DS:[ESI+0x14] * 0044D744 DB02 FILD DWORD PTR DS:[EDX] * 0044D746 85C0 TEST EAX,EAX * 0044D748 7D 06 JGE SHORT .0044D750 * 0044D74A D805 D05C9100 FADD DWORD PTR DS:[0x915CD0] * 0044D750 DEC1 FADDP ST(1),ST * 0044D752 D84424 28 FADD DWORD PTR SS:[ESP+0x28] * 0044D756 D95C24 20 FSTP DWORD PTR SS:[ESP+0x20] * 0044D75A D9EE FLDZ * 0044D75C D95C24 14 FSTP DWORD PTR SS:[ESP+0x14] * 0044D760 D94424 20 FLD DWORD PTR SS:[ESP+0x20] * 0044D764 D95C24 28 FSTP DWORD PTR SS:[ESP+0x28] * 0044D768 D94424 14 FLD DWORD PTR SS:[ESP+0x14] * 0044D76C FF86 88000000 INC DWORD PTR DS:[ESI+0x88] * 0044D772 D95C24 64 FSTP DWORD PTR SS:[ESP+0x64] * 0044D776 D94424 28 FLD DWORD PTR SS:[ESP+0x28] * 0044D77A 8D7E 6C LEA EDI,DWORD PTR DS:[ESI+0x6C] * 0044D77D 8D5C24 64 LEA EBX,DWORD PTR SS:[ESP+0x64] * 0044D781 D95C24 68 FSTP DWORD PTR SS:[ESP+0x68] * 0044D785 E8 B658FFFF CALL .00443040 * 0044D78A D9E8 FLD1 * 0044D78C 8B5C24 18 MOV EBX,DWORD PTR SS:[ESP+0x18] * 0044D790 83EC 0C SUB ESP,0xC * 0044D793 D95C24 08 FSTP DWORD PTR SS:[ESP+0x8] * 0044D797 8D46 54 LEA EAX,DWORD PTR DS:[ESI+0x54] * 0044D79A D94424 34 FLD DWORD PTR SS:[ESP+0x34] * 0044D79E 8B7424 4C MOV ESI,DWORD PTR SS:[ESP+0x4C] * 0044D7A2 D95C24 04 FSTP DWORD PTR SS:[ESP+0x4] * 0044D7A6 D94424 20 FLD DWORD PTR SS:[ESP+0x20] * 0044D7AA D91C24 FSTP DWORD PTR SS:[ESP] * 0044D7AD E8 1E040000 CALL .0044DBD0 * 0044D7B2 8D5C24 2C LEA EBX,DWORD PTR SS:[ESP+0x2C] * 0044D7B6 8D7C24 3C LEA EDI,DWORD PTR SS:[ESP+0x3C] * 0044D7BA E8 E1050000 CALL .0044DDA0 * 0044D7BF 0FB74C24 3C MOVZX ECX,WORD PTR SS:[ESP+0x3C] * 0044D7C4 8B7424 34 MOV ESI,DWORD PTR SS:[ESP+0x34] * 0044D7C8 8DBE A4000000 LEA EDI,DWORD PTR DS:[ESI+0xA4] * 0044D7CE 8D5C24 18 LEA EBX,DWORD PTR SS:[ESP+0x18] * 0044D7D2 894C24 18 MOV DWORD PTR SS:[ESP+0x18],ECX * 0044D7D6 E8 15C8FCFF CALL .00419FF0 * 0044D7DB 0FB74C24 2C MOVZX ECX,WORD PTR SS:[ESP+0x2C] * 0044D7E0 B8 56555555 MOV EAX,0x55555556 * 0044D7E5 F7E9 IMUL ECX * 0044D7E7 8BC2 MOV EAX,EDX * 0044D7E9 C1E8 1F SHR EAX,0x1F * 0044D7EC 03C2 ADD EAX,EDX * 0044D7EE 8DBE 8C000000 LEA EDI,DWORD PTR DS:[ESI+0x8C] * 0044D7F4 8D5C24 18 LEA EBX,DWORD PTR SS:[ESP+0x18] * 0044D7F8 894424 18 MOV DWORD PTR SS:[ESP+0x18],EAX * 0044D7FC E8 EFC7FCFF CALL .00419FF0 * 0044D801 8DBE D4000000 LEA EDI,DWORD PTR DS:[ESI+0xD4] * 0044D807 D94424 48 FLD DWORD PTR SS:[ESP+0x48] * 0044D80B 8D5C24 38 LEA EBX,DWORD PTR SS:[ESP+0x38] * 0044D80F D95C24 14 FSTP DWORD PTR SS:[ESP+0x14] * 0044D813 D94424 20 FLD DWORD PTR SS:[ESP+0x20] * 0044D817 D95C24 28 FSTP DWORD PTR SS:[ESP+0x28] * 0044D81B E8 D0C7FCFF CALL .00419FF0 * 0044D820 C74424 38 000000>MOV DWORD PTR SS:[ESP+0x38],0x0 * 0044D828 ^E9 3FFDFFFF JMP .0044D56C * 0044D82D C68424 C8000000 >MOV BYTE PTR SS:[ESP+0xC8],0x0 * 0044D835 83BC24 B4000000 >CMP DWORD PTR SS:[ESP+0xB4],0x10 * 0044D83D 72 10 JB SHORT .0044D84F * 0044D83F 8B8C24 A0000000 MOV ECX,DWORD PTR SS:[ESP+0xA0] * 0044D846 51 PUSH ECX * 0044D847 E8 29130600 CALL .004AEB75 * 0044D84C 83C4 04 ADD ESP,0x4 * 0044D84F 8B7C24 50 MOV EDI,DWORD PTR SS:[ESP+0x50] * 0044D853 8B5C24 54 MOV EBX,DWORD PTR SS:[ESP+0x54] * 0044D857 C78424 B4000000 >MOV DWORD PTR SS:[ESP+0xB4],0xF * 0044D862 C78424 B0000000 >MOV DWORD PTR SS:[ESP+0xB0],0x0 * 0044D86D C68424 A0000000 >MOV BYTE PTR SS:[ESP+0xA0],0x0 * 0044D875 85FF TEST EDI,EDI * 0044D877 75 19 JNZ SHORT .0044D892 * 0044D879 E8 16190600 CALL .004AF194 * 0044D87E 33C0 XOR EAX,EAX * 0044D880 3B58 10 CMP EBX,DWORD PTR DS:[EAX+0x10] * 0044D883 72 05 JB SHORT .0044D88A * 0044D885 E8 0A190600 CALL .004AF194 * 0044D88A 83C3 04 ADD EBX,0x4 * 0044D88D ^E9 03FCFFFF JMP .0044D495 * 0044D892 8B07 MOV EAX,DWORD PTR DS:[EDI] * 0044D894 ^EB EA JMP SHORT .0044D880 * 0044D896 66:8B5424 2C MOV DX,WORD PTR SS:[ESP+0x2C] * 0044D89B 66:8996 84000000 MOV WORD PTR DS:[ESI+0x84],DX * 0044D8A2 8B4E 64 MOV ECX,DWORD PTR DS:[ESI+0x64] * 0044D8A5 2B4E 60 SUB ECX,DWORD PTR DS:[ESI+0x60] * 0044D8A8 B8 67666666 MOV EAX,0x66666667 * 0044D8AD F7E9 IMUL ECX * 0044D8AF C1FA 03 SAR EDX,0x3 * 0044D8B2 8BC2 MOV EAX,EDX * 0044D8B4 C1E8 1F SHR EAX,0x1F * 0044D8B7 03C2 ADD EAX,EDX * 0044D8B9 74 0F JE SHORT .0044D8CA * 0044D8BB D94424 14 FLD DWORD PTR SS:[ESP+0x14] * 0044D8BF 51 PUSH ECX * 0044D8C0 8BC6 MOV EAX,ESI * 0044D8C2 D91C24 FSTP DWORD PTR SS:[ESP] * 0044D8C5 E8 36050000 CALL .0044DE00 * 0044D8CA 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C] * 0044D8D0 33DB XOR EBX,EBX * 0044D8D2 895C24 3C MOV DWORD PTR SS:[ESP+0x3C],EBX * 0044D8D6 895C24 2C MOV DWORD PTR SS:[ESP+0x2C],EBX * 0044D8DA 895C24 1C MOV DWORD PTR SS:[ESP+0x1C],EBX * 0044D8DE 895C24 20 MOV DWORD PTR SS:[ESP+0x20],EBX * 0044D8E2 894424 18 MOV DWORD PTR SS:[ESP+0x18],EAX * 0044D8E6 3986 98000000 CMP DWORD PTR DS:[ESI+0x98],EAX * 0044D8EC 76 05 JBE SHORT .0044D8F3 * 0044D8EE E8 A1180600 CALL .004AF194 * 0044D8F3 8BBE 98000000 MOV EDI,DWORD PTR DS:[ESI+0x98] * 0044D8F9 8B8E 8C000000 MOV ECX,DWORD PTR DS:[ESI+0x8C] * 0044D8FF 894C24 58 MOV DWORD PTR SS:[ESP+0x58],ECX * 0044D903 3BBE 9C000000 CMP EDI,DWORD PTR DS:[ESI+0x9C] * 0044D909 76 05 JBE SHORT .0044D910 * 0044D90B E8 84180600 CALL .004AF194 * 0044D910 8B86 8C000000 MOV EAX,DWORD PTR DS:[ESI+0x8C] * 0044D916 894424 40 MOV DWORD PTR SS:[ESP+0x40],EAX * 0044D91A 897C24 44 MOV DWORD PTR SS:[ESP+0x44],EDI * 0044D91E 895C24 34 MOV DWORD PTR SS:[ESP+0x34],EBX * 0044D922 3BC3 CMP EAX,EBX * 0044D924 74 06 JE SHORT .0044D92C * 0044D926 3B4424 58 CMP EAX,DWORD PTR SS:[ESP+0x58] * 0044D92A 74 05 JE SHORT .0044D931 * 0044D92C E8 63180600 CALL .004AF194 * 0044D931 8B5424 44 MOV EDX,DWORD PTR SS:[ESP+0x44] * 0044D935 3B5424 18 CMP EDX,DWORD PTR SS:[ESP+0x18] * 0044D939 0F84 0D010000 JE .0044DA4C * 0044D93F 8B4424 34 MOV EAX,DWORD PTR SS:[ESP+0x34] * 0044D943 33DB XOR EBX,EBX * 0044D945 8DBE EC000000 LEA EDI,DWORD PTR DS:[ESI+0xEC] * 0044D94B 894424 24 MOV DWORD PTR SS:[ESP+0x24],EAX * 0044D94F 8B4E 4C MOV ECX,DWORD PTR DS:[ESI+0x4C] * 0044D952 2B4E 48 SUB ECX,DWORD PTR DS:[ESI+0x48] * 0044D955 B8 67666666 MOV EAX,0x66666667 * 0044D95A F7E9 IMUL ECX * 0044D95C C1FA 03 SAR EDX,0x3 * 0044D95F 8BCA MOV ECX,EDX * 0044D961 C1E9 1F SHR ECX,0x1F * 0044D964 03CA ADD ECX,EDX * 0044D966 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+0x20] * 0044D96A 8D0413 LEA EAX,DWORD PTR DS:[EBX+EDX] * 0044D96D 3BC1 CMP EAX,ECX * 0044D96F 72 05 JB SHORT .0044D976 * 0044D971 E8 1E180600 CALL .004AF194 * 0044D976 8B46 48 MOV EAX,DWORD PTR DS:[ESI+0x48] * 0044D979 034424 24 ADD EAX,DWORD PTR SS:[ESP+0x24] * 0044D97D 8D8C24 88000000 LEA ECX,DWORD PTR SS:[ESP+0x88] * 0044D984 D900 FLD DWORD PTR DS:[EAX] * 0044D986 51 PUSH ECX * 0044D987 D99C24 8C000000 FSTP DWORD PTR SS:[ESP+0x8C] * 0044D98E D940 04 FLD DWORD PTR DS:[EAX+0x4] * 0044D991 D99C24 90000000 FSTP DWORD PTR SS:[ESP+0x90] * 0044D998 D940 08 FLD DWORD PTR DS:[EAX+0x8] * 0044D99B D99C24 94000000 FSTP DWORD PTR SS:[ESP+0x94] * 0044D9A2 D940 0C FLD DWORD PTR DS:[EAX+0xC] * 0044D9A5 D99C24 98000000 FSTP DWORD PTR SS:[ESP+0x98] * 0044D9AC D940 10 FLD DWORD PTR DS:[EAX+0x10] * 0044D9AF D99C24 9C000000 FSTP DWORD PTR SS:[ESP+0x9C] * 0044D9B6 E8 A50B0000 CALL .0044E560 * 0044D9BB 834424 24 14 ADD DWORD PTR SS:[ESP+0x24],0x14 * 0044D9C0 43 INC EBX * 0044D9C1 83FB 04 CMP EBX,0x4 * 0044D9C4 ^7C 89 JL SHORT .0044D94F * 0044D9C6 8D5C24 2C LEA EBX,DWORD PTR SS:[ESP+0x2C] * 0044D9CA 8D7C24 3C LEA EDI,DWORD PTR SS:[ESP+0x3C] * 0044D9CE E8 CD030000 CALL .0044DDA0 * 0044D9D3 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C] * 0044D9D9 2B86 98000000 SUB EAX,DWORD PTR DS:[ESI+0x98] * 0044D9DF 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+0x24] * 0044D9E3 BF 04000000 MOV EDI,0x4 * 0044D9E8 017C24 20 ADD DWORD PTR SS:[ESP+0x20],EDI * 0044D9EC C1F8 02 SAR EAX,0x2 * 0044D9EF 895424 34 MOV DWORD PTR SS:[ESP+0x34],EDX * 0044D9F3 394424 1C CMP DWORD PTR SS:[ESP+0x1C],EAX * 0044D9F7 72 05 JB SHORT .0044D9FE * 0044D9F9 E8 96170600 CALL .004AF194 * 0044D9FE 8B8E B4000000 MOV ECX,DWORD PTR DS:[ESI+0xB4] * 0044DA04 2B8E B0000000 SUB ECX,DWORD PTR DS:[ESI+0xB0] * 0044DA0A C1F9 02 SAR ECX,0x2 * 0044DA0D 394C24 1C CMP DWORD PTR SS:[ESP+0x1C],ECX * 0044DA11 72 05 JB SHORT .0044DA18 * 0044DA13 E8 7C170600 CALL .004AF194 * 0044DA18 8B4424 40 MOV EAX,DWORD PTR SS:[ESP+0x40] * 0044DA1C FF4424 1C INC DWORD PTR SS:[ESP+0x1C] * 0044DA20 85C0 TEST EAX,EAX * 0044DA22 75 24 JNZ SHORT .0044DA48 * 0044DA24 E8 6B170600 CALL .004AF194 * 0044DA29 33C0 XOR EAX,EAX * 0044DA2B 8B5424 44 MOV EDX,DWORD PTR SS:[ESP+0x44] * 0044DA2F 3B50 10 CMP EDX,DWORD PTR DS:[EAX+0x10] * 0044DA32 72 05 JB SHORT .0044DA39 * 0044DA34 E8 5B170600 CALL .004AF194 * 0044DA39 017C24 44 ADD DWORD PTR SS:[ESP+0x44],EDI * 0044DA3D 8B4424 40 MOV EAX,DWORD PTR SS:[ESP+0x40] * 0044DA41 33DB XOR EBX,EBX * 0044DA43 ^E9 DAFEFFFF JMP .0044D922 * 0044DA48 8B00 MOV EAX,DWORD PTR DS:[EAX] * 0044DA4A ^EB DF JMP SHORT .0044DA2B * 0044DA4C 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C] * 0044DA52 2B86 98000000 SUB EAX,DWORD PTR DS:[ESI+0x98] * 0044DA58 8D4C24 6C LEA ECX,DWORD PTR SS:[ESP+0x6C] * 0044DA5C C1F8 02 SAR EAX,0x2 * 0044DA5F 8946 38 MOV DWORD PTR DS:[ESI+0x38],EAX * 0044DA62 C78424 C8000000 >MOV DWORD PTR SS:[ESP+0xC8],-0x1 * 0044DA6D E8 CE0E0000 CALL .0044E940 * 0044DA72 8B8C24 C0000000 MOV ECX,DWORD PTR SS:[ESP+0xC0] * 0044DA79 64:890D 00000000 MOV DWORD PTR FS:[0],ECX * 0044DA80 59 POP ECX * 0044DA81 5F POP EDI * 0044DA82 5E POP ESI * 0044DA83 5B POP EBX * 0044DA84 8B8C24 A8000000 MOV ECX,DWORD PTR SS:[ESP+0xA8] * 0044DA8B 33CC XOR ECX,ESP * 0044DA8D E8 EE100600 CALL .004AEB80 * 0044DA92 8BE5 MOV ESP,EBP * 0044DA94 5D POP EBP * 0044DA95 C2 0400 RETN 0x4 * 0044DA98 20D6 AND DH,DL * 0044DA9A 44 INC ESP * 0044DA9B 0028 ADD BYTE PTR DS:[EAX],CH * 0044DA9D D6 SALC * 0044DA9E 44 INC ESP * 0044DA9F 0038 ADD BYTE PTR DS:[EAX],BH * 0044DAA1 D6 SALC * 0044DAA2 44 INC ESP * 0044DAA3 0048 D6 ADD BYTE PTR DS:[EAX-0x2A],CL * 0044DAA6 44 INC ESP * 0044DAA7 00CC ADD AH,CL * 0044DAA9 CC INT3 * 0044DAAA CC INT3 * 0044DAAB CC INT3 * 0044DAAC CC INT3 * 0044DAAD CC INT3 * 0044DAAE CC INT3 * 0044DAAF CC INT3 */ bool attach(ULONG startAddress, ULONG stopAddress) // attach scenario { const uint8_t bytes[] = { 0x57, // 0044d696 57 push edi 0x8b,0xc3, // 0044d697 8bc3 mov eax,ebx 0xe8, XX4, // 0044d699 e8 6249fdff call .00422000 0x89,0x44,0x24, 0x18, // 0044d69e 894424 18 mov dword ptr ss:[esp+0x18],eax ; jichi: this is the ith hook point 0x85,0xc0, // 0044d6a2 85c0 test eax,eax 0x0f,0x84 //c2feffff // 0044d6a4 ^0f84 c2feffff je .0044d56c }; ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress); if (!addr) return false; addr = MemDbg::findEnclosingAlignedFunction(addr); // range is around 50, use 80 if (!addr) return false; HookParam hp; hp.address=addr; hp.type=USING_STRING|EMBED_ABLE|EMBED_AFTER_NEW| EMBED_DYNA_SJIS; hp.offset=get_stack(1); hp.hook_before=Private::hookBefore; hp.hook_font=F_GetGlyphOutlineA; return NewHook(hp,"EmbedNexton"); } } // namespace ScenarioHook } // unnamed namespace bool Nexton::attach_function() { bool embed=ScenarioHook::attach(processStartAddress,processStopAddress); return InsertNextonHook()||embed; } /** jichi 8/17/2014 Nexton1 * Sample games: * - [Nomad][071026] 淫烙�巫女 Trial * * Debug method: text are prefetched into memory. Add break point to it. * * GetGlyphOutlineA is called, but no correct text. * * There are so many good hooks. The shortest function was picked,as follows: * 0041974e cc int3 * 0041974f cc int3 * 00419750 56 push esi ; jichi: hook here, text in arg1 * 00419751 8b7424 08 mov esi,dword ptr ss:[esp+0x8] * 00419755 8bc6 mov eax,esi * 00419757 57 push edi * 00419758 8d78 01 lea edi,dword ptr ds:[eax+0x1] * 0041975b eb 03 jmp short inrakutr.00419760 * 0041975d 8d49 00 lea ecx,dword ptr ds:[ecx] * 00419760 8a10 mov dl,byte ptr ds:[eax] ; jichi: eax is the text * 00419762 83c0 01 add eax,0x1 * 00419765 84d2 test dl,dl * 00419767 ^75 f7 jnz short inrakutr.00419760 * 00419769 2bc7 sub eax,edi * 0041976b 50 push eax * 0041976c 56 push esi * 0041976d 83c1 04 add ecx,0x4 * 00419770 e8 eb85feff call inrakutr.00401d60 * 00419775 5f pop edi * 00419776 5e pop esi * 00419777 c2 0400 retn 0x4 * 0041977a cc int3 * 0041977b cc int3 * 0041977c cc int3 * * Runtime stack: this function takes two arguments. Text address is in arg1. * * Other possible hooks are as follows: * 00460caf 53 push ebx * 00460cb0 c700 16000000 mov dword ptr ds:[eax],0x16 * 00460cb6 e8 39feffff call inrakutr.00460af4 * 00460cbb 83c4 14 add esp,0x14 * 00460cbe 385d fc cmp byte ptr ss:[ebp-0x4],bl * 00460cc1 74 07 je short inrakutr.00460cca * 00460cc3 8b45 f8 mov eax,dword ptr ss:[ebp-0x8] * 00460cc6 8360 70 fd and dword ptr ds:[eax+0x70],0xfffffffd * 00460cca 33c0 xor eax,eax * 00460ccc eb 2c jmp short inrakutr.00460cfa * 00460cce 0fb601 movzx eax,byte ptr ds:[ecx] ; jichi: here, ecx * 00460cd1 8b55 f4 mov edx,dword ptr ss:[ebp-0xc] * 00460cd4 f64410 1d 04 test byte ptr ds:[eax+edx+0x1d],0x4 * 00460cd9 74 0e je short inrakutr.00460ce9 * 00460cdb 8d51 01 lea edx,dword ptr ds:[ecx+0x1] * 00460cde 381a cmp byte ptr ds:[edx],bl * 00460ce0 74 07 je short inrakutr.00460ce9 * 00460ce2 c1e0 08 shl eax,0x8 * 00460ce5 8bf0 mov esi,eax * 00460ce7 8bca mov ecx,edx * 00460ce9 0fb601 movzx eax,byte ptr ds:[ecx] * 00460cec 03c6 add eax,esi * 00460cee 385d fc cmp byte ptr ss:[ebp-0x4],bl * 00460cf1 74 07 je short inrakutr.00460cfa * 00460cf3 8b4d f8 mov ecx,dword ptr ss:[ebp-0x8] * 00460cf6 8361 70 fd and dword ptr ds:[ecx+0x70],0xfffffffd * 00460cfa 5e pop esi * 00460cfb 5b pop ebx * 00460cfc c9 leave * 00460cfd c3 retn * * 00460d41 74 05 je short inrakutr.00460d48 * 00460d43 381e cmp byte ptr ds:[esi],bl * 00460d45 74 01 je short inrakutr.00460d48 * 00460d47 46 inc esi * 00460d48 8bc6 mov eax,esi * 00460d4a 5e pop esi * 00460d4b 5b pop ebx * 00460d4c c3 retn * 00460d4d 56 push esi * 00460d4e 8b7424 08 mov esi,dword ptr ss:[esp+0x8] * 00460d52 0fb606 movzx eax,byte ptr ds:[esi] ; jichi: esi & ebp * 00460d55 50 push eax * 00460d56 e8 80fcffff call inrakutr.004609db * 00460d5b 85c0 test eax,eax * 00460d5d 59 pop ecx * 00460d5e 74 0b je short inrakutr.00460d6b * 00460d60 807e 01 00 cmp byte ptr ds:[esi+0x1],0x0 * 00460d64 74 05 je short inrakutr.00460d6b * 00460d66 6a 02 push 0x2 * 00460d68 58 pop eax * 00460d69 5e pop esi * 00460d6a c3 retn * * 00460d1d 53 push ebx * 00460d1e 53 push ebx * 00460d1f 53 push ebx * 00460d20 53 push ebx * 00460d21 53 push ebx * 00460d22 c700 16000000 mov dword ptr ds:[eax],0x16 * 00460d28 e8 c7fdffff call inrakutr.00460af4 * 00460d2d 83c4 14 add esp,0x14 * 00460d30 33c0 xor eax,eax * 00460d32 eb 16 jmp short inrakutr.00460d4a * 00460d34 0fb606 movzx eax,byte ptr ds:[esi] ; jichi: esi, ebp * 00460d37 50 push eax * 00460d38 e8 9efcffff call inrakutr.004609db * 00460d3d 46 inc esi * 00460d3e 85c0 test eax,eax * 00460d40 59 pop ecx * 00460d41 74 05 je short inrakutr.00460d48 * 00460d43 381e cmp byte ptr ds:[esi],bl * 00460d45 74 01 je short inrakutr.00460d48 * 00460d47 46 inc esi * * 0042c59f cc int3 * 0042c5a0 56 push esi * 0042c5a1 8bf1 mov esi,ecx * 0042c5a3 8b86 cc650000 mov eax,dword ptr ds:[esi+0x65cc] * 0042c5a9 8b50 1c mov edx,dword ptr ds:[eax+0x1c] * 0042c5ac 57 push edi * 0042c5ad 8b7c24 0c mov edi,dword ptr ss:[esp+0xc] * 0042c5b1 8d8e cc650000 lea ecx,dword ptr ds:[esi+0x65cc] * 0042c5b7 57 push edi * 0042c5b8 ffd2 call edx * 0042c5ba 8bc7 mov eax,edi * 0042c5bc 8d50 01 lea edx,dword ptr ds:[eax+0x1] * 0042c5bf 90 nop * 0042c5c0 8a08 mov cl,byte ptr ds:[eax] ; jichi: here eax * 0042c5c2 83c0 01 add eax,0x1 * 0042c5c5 84c9 test cl,cl * 0042c5c7 ^75 f7 jnz short inrakutr.0042c5c0 * 0042c5c9 2bc2 sub eax,edx * 0042c5cb 50 push eax * 0042c5cc 57 push edi * 0042c5cd 8d8e 24660000 lea ecx,dword ptr ds:[esi+0x6624] * 0042c5d3 e8 8857fdff call inrakutr.00401d60 * 0042c5d8 8b86 b4660000 mov eax,dword ptr ds:[esi+0x66b4] * 0042c5de 85c0 test eax,eax * 0042c5e0 74 0d je short inrakutr.0042c5ef * 0042c5e2 8b8e b8660000 mov ecx,dword ptr ds:[esi+0x66b8] * 0042c5e8 2bc8 sub ecx,eax * 0042c5ea c1f9 02 sar ecx,0x2 * 0042c5ed 75 05 jnz short inrakutr.0042c5f4 * 0042c5ef e8 24450300 call inrakutr.00460b18 * 0042c5f4 8b96 b4660000 mov edx,dword ptr ds:[esi+0x66b4] * 0042c5fa 8b0a mov ecx,dword ptr ds:[edx] * 0042c5fc 8b01 mov eax,dword ptr ds:[ecx] * 0042c5fe 8b50 30 mov edx,dword ptr ds:[eax+0x30] * 0042c601 ffd2 call edx * 0042c603 8b06 mov eax,dword ptr ds:[esi] * 0042c605 8b90 f8000000 mov edx,dword ptr ds:[eax+0xf8] * 0042c60b 6a 00 push 0x0 * 0042c60d 68 c3164a00 push inrakutr.004a16c3 * 0042c612 57 push edi * 0042c613 8bce mov ecx,esi * 0042c615 ffd2 call edx * 0042c617 5f pop edi * 0042c618 5e pop esi * 0042c619 c2 0400 retn 0x4 * 0042c61c cc int3 * * 0041974e cc int3 * 0041974f cc int3 * 00419750 56 push esi * 00419751 8b7424 08 mov esi,dword ptr ss:[esp+0x8] * 00419755 8bc6 mov eax,esi * 00419757 57 push edi * 00419758 8d78 01 lea edi,dword ptr ds:[eax+0x1] * 0041975b eb 03 jmp short inrakutr.00419760 * 0041975d 8d49 00 lea ecx,dword ptr ds:[ecx] * 00419760 8a10 mov dl,byte ptr ds:[eax] ; jichi: eax * 00419762 83c0 01 add eax,0x1 * 00419765 84d2 test dl,dl * 00419767 ^75 f7 jnz short inrakutr.00419760 * 00419769 2bc7 sub eax,edi * 0041976b 50 push eax * 0041976c 56 push esi * 0041976d 83c1 04 add ecx,0x4 * 00419770 e8 eb85feff call inrakutr.00401d60 * 00419775 5f pop edi * 00419776 5e pop esi * 00419777 c2 0400 retn 0x4 * 0041977a cc int3 * 0041977b cc int3 * 0041977c cc int3 * * 0042c731 57 push edi * 0042c732 ffd0 call eax * 0042c734 8bc7 mov eax,edi * 0042c736 8d50 01 lea edx,dword ptr ds:[eax+0x1] * 0042c739 8da424 00000000 lea esp,dword ptr ss:[esp] * 0042c740 8a08 mov cl,byte ptr ds:[eax] ; jichi: eax * 0042c742 83c0 01 add eax,0x1 * 0042c745 84c9 test cl,cl * 0042c747 ^75 f7 jnz short inrakutr.0042c740 * 0042c749 2bc2 sub eax,edx * 0042c74b 8bf8 mov edi,eax * 0042c74d e8 fe1d0100 call inrakutr.0043e550 * 0042c752 8b0d 187f4c00 mov ecx,dword ptr ds:[0x4c7f18] * 0042c758 8b11 mov edx,dword ptr ds:[ecx] * 0042c75a 8b42 70 mov eax,dword ptr ds:[edx+0x70] * 0042c75d ffd0 call eax * 0042c75f 83c0 0a add eax,0xa * 0042c762 0fafc7 imul eax,edi * 0042c765 5f pop edi * 0042c766 8986 60660000 mov dword ptr ds:[esi+0x6660],eax */ bool InsertNexton1Hook() { const BYTE bytes[] = { 0x56, // 00419750 56 push esi ; jichi: hook here, text in arg1 0x8b,0x74,0x24, 0x08, // 00419751 8b7424 08 mov esi,dword ptr ss:[esp+0x8] 0x8b,0xc6, // 00419755 8bc6 mov eax,esi 0x57, // 00419757 57 push edi 0x8d,0x78, 0x01, // 00419758 8d78 01 lea edi,dword ptr ds:[eax+0x1] 0xeb, 0x03, // 0041975b eb 03 jmp short inrakutr.00419760 0x8d,0x49, 0x00, // 0041975d 8d49 00 lea ecx,dword ptr ds:[ecx] 0x8a,0x10, // 00419760 8a10 mov dl,byte ptr ds:[eax] ; jichi: eax is the text 0x83,0xc0, 0x01, // 00419762 83c0 01 add eax,0x1 0x84,0xd2, // 00419765 84d2 test dl,dl 0x75, 0xf7, // 00419767 ^75 f7 jnz short inrakutr.00419760 0x2b,0xc7, // 00419769 2bc7 sub eax,edi 0x50, // 0041976b 50 push eax 0x56, // 0041976c 56 push esi 0x83,0xc1, 0x04 // 0041976d 83c1 04 add ecx,0x4 //0xe8, XX4, // 00419770 e8 eb85feff call inrakutr.00401d60 //0x5f, // 00419775 5f pop edi //0x5e, // 00419776 5e pop esi //0xc2, 0x04,0x00 // 00419777 c2 0400 retn 0x4 }; enum { addr_offset = 0 }; // distance to the beginning of the function ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress); //GROWL_DWORD(addr); // supposed to be 0x4010e0 if (!addr) { ConsoleOutput("NEXTON1: pattern not found"); return false; } //GROWL_DWORD(addr); HookParam hp; hp.address = addr + addr_offset; //hp.length_offset = 1; hp.offset=get_stack(1); // [esp+4] == arg0 hp.type = USING_STRING; ConsoleOutput("INSERT NEXTON1"); return NewHook(hp, "NEXTON1"); } bool Nexton1::attach_function() { return InsertNexton1Hook(); }